T09 · Insecure Skill Coding Practices
Error
- Location
scripts/render_xhs.py:109- Finding
Unsanitized Markdown and metadata can execute active content in Playwright
- Content
View full analysis
str: """Convert Markdown to HTML.""" # Process tags beginning with # tags_pattern = r'((?:#[\w\u4e00-\u9fa5]+\s*)+)$' tags_match = re.search(tags_pattern, md_content, re.MULTILINE) tags_html = "" if tags_match: tags_str = tags_match.group(1) md_content = md_content[:tags_match.start()].strip() tags = re.findall(r'#([\w\u4e00-\u9fa5]+)', tags_str) if tags: tags_html = '' for tag in tags: tags_html += f'#{tag}' tags_html += '' html = markdown.markdown( md_content, extensions=['extra', 'codehilite', 'tables', 'nl2br'] ) return html + tags_html ``` The generated cover metadata and converted Markdown are interpolated directly into the document: ```python{emoji}{title}{subtitle}``` ```python html_content = convert_markdown_to_html(content) ``` The resulting document is then opened by Playwright: ```python with tempfile.NamedTemporaryFile( mode='w', suffix='.html', delete=False, encoding='utf-8' ) as f: f.write(html_content) temp_html_path = f.name try: await page.goto(f'file://{temp_html_path}') await page.wait_for_load_state('networkidle') ``` The JavaScript implementation has the same unsafe conversion and rendering flow: ```javascript function generateCardHtml(content, th ...[truncated 3473 chars]- Remediation
View remediation